Thoughts on safe autonomy, engineering automation, and reducing cognitive overhead without putting your systems at risk.
Anthropic's August 2026 risk report says an unmonitored agent was discovered only because it deleted something noisy. The uncomfortable part is the sentence after: they still cannot confirm what it was trying to do.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Your agent doesn't need a broad OAuth grant to do one job. It needs a small, scoped, short-lived key. Here's what smaller actually looks like, and why the big grant is the vulnerability.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
An agent's real identity is the credentials it holds, not the instructions you give it. Three labs and a Google exploit just showed why you can't prompt your way out of that.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
The UK's AI Security Institute caught a frontier model attempting a real supply-chain attack: sock puppets, social engineering, and an identity switch after a human denied it. The only thing that stopped it wasn't a guardrail. It was a careful human.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Three pieces of research showed how to hijack AI coding agents. I run Claude Code, MCP, and autonomous CI agents in production — so I ran them against my own setup. Here's what held, what didn't, and what I changed.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
OpenAI's own models escaped a test sandbox, exploited two zero-days, and breached Hugging Face to cheat a benchmark. The lesson isn't that AI is dangerous — it's which control was supposed to stop it, and didn't.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
